TTR Networks

Intermediate · IPv6 on the Debian router · section 1 of 7

A prefix, not an address

✓ Lab-tested 5 November 2026 on Debian 13.7, systemd 257, nftables 1.1.3, Kea 2.6.3

Add IPv6 to a Debian router with systemd-networkd: ask the ISP for a /56 by DHCPv6 prefix delegation, give each VLAN a /64 and announce it with router advertisements, firewall it with nftables (including the ICMPv6 IPv6 can't work without), and see what happens when the ISP changes the prefix.

By the end you will be able to:

  • Request a delegated IPv6 prefix from an ISP with systemd-networkd's DHCPv6 client
  • Give each VLAN a /64 from the delegated prefix and announce it with router advertisements
  • Write an nftables policy for IPv6, including the ICMPv6 and DHCPv6 traffic it needs
  • Explain why the forward policy matters more without NAT
  • Recognise what happens when the ISP changes the prefix, and diagnose missing prefixes and broken neighbour discovery

Prerequisites: Debian as an office router: interfaces, VLANs and a firewall

The router so far is IPv4-only: one public address, shared by the whole office through NAT. IPv6 works differently, and most ISPs now offer it. Instead of one address, the ISP delegates a whole prefix to your router, typically a /56: 256 networks of 2⁶⁴ addresses each. The router gives one /64 to each VLAN and announces it, and every device gets a public address of its own. No NAT, and so the firewall matters more, not less.

This lesson adds IPv6 to the router from Debian as an office router, using only systemd-networkd and nftables:

  1. Ask the ISP for a prefix with DHCPv6 prefix delegation (DHCPv6-PD) on the WAN.
  2. Split it across the VLANs: one /64 each, numbered after the VLAN.
  3. Announce it with router advertisements, so devices configure themselves (SLAAC).
  4. Firewall it: the same policy as IPv4, plus the ICMPv6 that IPv6 can't work without.
  5. Survive a new prefix when the ISP changes it.

IPv6 on VyOS does the same on VyOS, with more background on IPv6 addressing.

The lab

The ISP's router now runs Kea, ISC's DHCP server, configured to delegate a /56 from 2001:db8:ab00::/48 to each customer, and routes that prefix to whichever router asked for it. The link between the router and the ISP is 2001:db8:f::/64 (the router is ::2), and the web server on the internet side is 2001:db8:e::10. The ISP's Kea configuration is in Build the lab yourself.

Diagram: IPv6 on the router — The ISP delegates a /56; the router gives each VLAN a /64 and announces it.
  1. Ask for a prefix. The router sends a DHCPv6 solicit with a prefix-delegation request. The ISP's Kea answers with a /56, and routes it to the router.
  2. One /64 per VLAN. networkd gives each VLAN the /64 picked by its SubnetId (510, 520, 530), with the router at ::1, and adds an unreachable route for the rest of the /56.
  3. Router advertisements. The router announces each VLAN's /64. Devices build their own addresses from it (SLAAC) and use the router's link-local address as their gateway.
  4. Public addresses, same policy. Staff reach the web server with their own address: no NAT. The forward chain's verdict map still decides who may start connections, so the internet can't reach the file server.
The ISP's DHCPv6 server (real output)
root@isp:~# kea-dhcp6 -V | head -1
2.6.3 (tarball)
  • Line 2: Kea 2.6.3, from Debian 13. The router itself uses only systemd-networkd 257, as before.